IN THE CLAIMS: 



The following is a current listing of claims and will replace all prior versions and listings 
of claims in the application. Please amend the claims as follows: 

1-133. (Canceled 

134. (Currently Amended) A tangible computer-readable memory medium storing program 
instructions that are executable on an information handling system to: 

receive data from an external network coupled to the information handling system i 
wherein the received data includes a first set of data for a web page ; 

analyze the first set of received data to make a determination whether the received first 
set of data indicates that it is from a first source coupled to the external network, but is actually 
from a second source coupled to the external network; and 

wherein the determination is based, at least in part, on an age of the received first set of 
data , and/or a siz e of the received data . 

135. (Currently Amended) The tangible computer-readable memory medium of claim 134, 
wherein the received first set of data includes information indicating that it is from a source 
trusted by a user of the information handling system. 

136. (Currently Amended) The tangible computer-readable memory medium of claim 135, 
wherein the received first set of data is intended to cause the user to supply confidential 
information to a source other than the trusted source. 

137. (Previously Presented) The tangible computer-readable memory medium of claim 136, 
wherein the confidential information is financial information of the user. 

138. (Previously Presented) The tangible computer-readable memory medium of claim 136, 
wherein the confidential information is login information of the user. 
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139. (Currently Amended) A method, comprising: 

receiving a web page at a first computing device via a wide-area network, wherein the 
web page includes information indicating that its origin is a first source that is trusted by a user 
of the first computing device; 

sending data to the web page that is requested by the web page to the origin of the web 
page ; and 

analyzing the origin's response to the sent data to determine whether the origin of the 
received web page is the first source. 

140-141. (Canceled) 

142. (Previously Presented) The method of claim 139, wherein the web page solicits 
confidential information from the user. 

143-152. (Canceled) 

153. (Previously Presented) A method, comprising: 

making a determination of the likelihood that a web page received from a first computer 
network is misrepresented as being from a trusted source, including: 
analyzing a layout of the web page; and 

determining that the layout of the web page is similar to a layout of a known 
mistrusted web page. 

154. (Previously Presented) The method of claim 153, wherein said making said determination 
further includes determining whether the web page's markup language contains the trusted 
source's name or logo and whether the web page has the same organization of content as the 
trusted source. 
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155. (Previously Presented) A method, comprising: 

making a determination of the likelihood that a web page received from a first computer 
network is misrepresented as being from a trusted source, wherein the determination is based on 
one or more of the following criteria: an age of the web page, a size of the web page, a number 
of hyperlinks to the web page from trusted sources. 

156. (Previously Presented) The method of claim 155, wherein the determination is based, at 
least in part, on the age of the web page and the size of the web page. 

157. (Previously Presented) The method of claim 155, wherein the determination is based, at 
least in part, on the age of the web page and the number of hyperlinks to the web page from 
trusted sources. 

158. (Previously Presented) A tangible computer-readable memory medium storing program 
instructions that are executable on a computing device to: 

make a determination of the likelihood that a web page received from a first computer 
network is misrepresented as being from a trusted source coupled to the first computer network, 
including: 

analyzing a layout of the web page; and 

determining that the layout of the web page is similar to a layout of a known mistrusted 
web page. 

159. (Previously Presented) A tangible computer-readable memory medium storing program 
instructions that are executable on a computing device to: 

make a determination of the likelihood that a web page received at the computing device 
from a first computer network is misrepresented as being from a trusted source, wherein the 
determination is based on one or more of the following criteria: an age of the web page, a size of 
the web page, a number of hyperlinks to the web page from known trusted sources. 
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160. (New) A tangible computer-readable memory medium storing program instructions that 
are executable on a computing device to: 

receive a web page at a first computing device via a wide-area network, wherein the web 
page includes information indicating that its origin is a first source that is trusted by a user of the 
first computing device; 

send data that is requested by the web page to the origin of the web page; and 
analyze the origin's response to the sent data to determine whether the origin of the web 
page is the first source. 

161 . (New) A tangible computer-readable memory medium storing program instructions that 
are executable on an information handling system to: 

receive data from an external network coupled to the information handling system; 

analyze the received data to make a determination whether the received data indicates 
that it is from a first source coupled to the external network, but is actually from a second source 
coupled to the external network; and 

wherein the determination is based, at least in part, on a size of the received data. 

1 62. (New) The tangible computer-readable memory medium of claim 161, wherein the 
received data is data for a first web page, and wherein the determination is based, at least in part, 
on the size of the first web page. 
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